Communications network tap with heartbeat monitor

Abstract

A communications network tap, comprises a first terminal and a second terminal adapted to couple the tap in-line in the network and communicate data packets with network devices. A heartbeat generator is configured to generate a heartbeat signal, and a heartbeat insert circuit coupled to the first terminal and the heartbeat generator and configured to insert the heartbeat signal into data packets. A third terminal is coupled to the heartbeat insert circuit and adapted to couple the tap to a network monitor and communicate data packets with network monitor. A heartbeat remove circuit is coupled to the third terminal and configured to receive data packets from a network monitor and remove the heartbeat signal from the data packets. A heartbeat detector coupled to the heartbeat remove circuit and configured to detect whether the data packets include the heartbeat signal, and if not, to generate an alarm signal. A switch is coupled to the second terminal and configured to transmit data packets onto the network. Advantages of the invention include ensuring the integrity of network monitoring equipment.

1. A network tap for detecting a fault in a network component, the network tap comprising:
 a heartbeat generator for generating a heartbeat signal; 
 a heartbeat insert circuit for receiving a first set of data, inserting the heartbeat signal into the first set of data, and providing the first set of data, with the heartbeat signal inserted, to the network component; 
 a heartbeat remove circuit for receiving a second set of data from the network component and, if the second set of data includes the heartbeat signal, removing the heartbeat signal from the second set of data; and 
 a heartbeat detector for detecting the heartbeat signal and, if the heartbeat signal is not detected, generating an alarm signal, the heartbeat detector being coupled to the heartbeat remove circuit. 
 
   
   
     2. The network tap of  claim 1  wherein the network component includes at least one of a network monitor, a switch, a router, a server computer, and a client computer. 
   
   
     3. The network tap of  claim 1  wherein the heartbeat signal is inserted periodically. 
   
   
     4. The network tap of  claim 1  where the heartbeat detector generates the alarm signal if the heartbeat signal is not detected within a predetermined time interval or by a predetermined time. 
   
   
     5. The network tap of  claim 1  further comprising a switch coupled to at least one of the heartbeat insert circuit and the heartbeat remove circuit the switch being configured to perform at least one of receiving and transmitting one or more of the first set of data, the second set of data, and the second set of data less the heartbeat signal. 
   
   
     6. The network tap of  claim 1  further comprising a switch configured to, on receipt of the alarm signal, perform a bypass of data traffic. 
   
   
     7. The network tap of  claim 1  further comprising a switch configured to provide a copy of the first set of data to a second network component. 
   
   
     8. The network tap of  claim 1  further comprising a converter configured to convert optical signals pertaining to the first set of data into electronic signals before the heartbeat signal is inserted. 
   
   
     9. The network tap of  claim 1  further comprising a converter configured to convert electronic signals pertaining to at least one of the second set of data and the second set of data less the heartbeat signal into optical signals. 
   
   
     10. The network tap of  claim 1  wherein the network component represents at least one of an intrusion detection device, an intrusion prevention device, an in-band monitor, and a protocol analyzer. 
   
   
     11. A method for detecting a fault in a network component, the method comprising:
 generating a heartbeat signal; 
 receiving a first set of data; 
 inserting the heartbeat signal into the first set of data; 
 providing the first set of data, with the heartbeat signal inserted, to the network component; 
 receiving a second set of data from the network component; 
 detecting whether the second set of data includes the heartbeat signal; 
 generating an alarm signal if the heartbeat signal is not detected; and 
 removing the heartbeat signal from the second set of data if the second set of data includes the heartbeat signal 
 
   
   
     12. The method of  claim 11  wherein the network component includes at least one of a network monitor, a switch, a router, a server computer, and a client computer. 
   
   
     13. The method of  claim 11  further comprising periodically inserting the heartbeat signal. 
   
   
     14. The method of  claim 11  where the alarm signal is generated if the heartbeat signal is not detected within a predetermined time interval or by a predetermined time. 
   
   
     15. The method of  claim 11  further comprising transmitting at least one of the second set of data and the second set of data less the heartbeat signal to a network device other than the network component. 
   
   
     16. The method of  claim 11  further comprising performing a bypass of data traffic after the alarm signal is generated. 
   
   
     17. The method of  claim 11  further comprising providing a copy of the first set of data to a second network component. 
   
   
     18. The method of  claim 11  further comprising converting optical signals pertaining to the first set of data into electronic signals before the heartbeat signal is inserted. 
   
   
     19. The method of  claim 11  further comprising converting electronic signals pertaining to at least one of the second set of data and the second set of data less the heartbeat signal into optical signals. 
   
   
     20. The method of  claim 11  wherein the network component represents at least one of an intrusion detection device, an intrusion prevention device, an in-band monitor, and a protocol analyzer.